[to-be-updated] powerpc-xive-fix-use-after-free-of-xive_ipis.patch removed from -mm tree

[to-be-updated] powerpc-xive-fix-use-after-free-of-xive_ipis.patch removed from -mm tree

[Andrew Morton]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 3869 bytes --]


The quilt patch titled
     Subject: powerpc/xive: fix use-after-free of xive_ipis
has been removed from the -mm tree.  Its filename was
     powerpc-xive-fix-use-after-free-of-xive_ipis.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Gou Hao <gouhao@uniontech.com>
Subject: powerpc/xive: fix use-after-free of xive_ipis
Date: Fri, 24 Jul 2026 10:28:48 +0800

When irq_domain_alloc_irqs() fails in xive_init_ipis(), the error path
frees the global xive_ipis array via kfree().  However, xive_smp_probe()
ignores the error return and proceeds to call xive_setup_cpu_ipi(), which
dereferences the already-freed xive_ipis pointer, resulting in a
use-after-free.

Propagate the error from xive_init_ipis() through xive_smp_probe() and
check it in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup
is aborted cleanly on failure.

Link: https://lore.kernel.org/20260724022851.466017-4-gouhao@uniontech.com
Fixes: 7dcc37b3eff9 ("powerpc/xive: Map one IPI interrupt per node")
Signed-off-by: Gou Hao <gouhao@uniontech.com>
Reviewed-by: Wentao Guan <guanwentao@uniontech.com>
Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Cc: Bharat Potnuri <bharat@chelsio.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nam Cao <namcao@linutronix.de>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Nilay Shroff <nilay@linux.ibm.com>
Cc: Shrikanth Hegde <sshegde@linux.ibm.com>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/powerpc/platforms/powernv/smp.c |    8 +++++---
 arch/powerpc/platforms/pseries/smp.c |    8 +++++---
 arch/powerpc/sysdev/xive/common.c    |    6 +++++-
 3 files changed, 15 insertions(+), 7 deletions(-)

--- a/arch/powerpc/platforms/powernv/smp.c~powerpc-xive-fix-use-after-free-of-xive_ipis
+++ a/arch/powerpc/platforms/powernv/smp.c
@@ -332,10 +332,12 @@ static void pnv_cause_ipi(int cpu)
 
 static void __init pnv_smp_probe(void)
 {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
 		xics_smp_probe();
+	}
 
 	if (cpu_has_feature(CPU_FTR_DBELL)) {
 		ic_cause_ipi = smp_ops->cause_ipi;
--- a/arch/powerpc/platforms/pseries/smp.c~powerpc-xive-fix-use-after-free-of-xive_ipis
+++ a/arch/powerpc/platforms/pseries/smp.c
@@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu
 
 static __init void pSeries_smp_probe(void)
 {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
 		xics_smp_probe();
+	}
 
 	/* No doorbell facility, must use the interrupt controller for IPIs */
 	if (!cpu_has_feature(CPU_FTR_DBELL))
--- a/arch/powerpc/sysdev/xive/common.c~powerpc-xive-fix-use-after-free-of-xive_ipis
+++ a/arch/powerpc/sysdev/xive/common.c
@@ -1256,10 +1256,14 @@ noinstr static void xive_cleanup_cpu_ipi
 
 int __init xive_smp_probe(void)
 {
+	int ret;
+
 	smp_ops->cause_ipi = xive_cause_ipi;
 
 	/* Register the IPI */
-	xive_init_ipis();
+	ret = xive_init_ipis();
+	if (ret < 0)
+		return ret;
 
 	/* Allocate and setup IPI for the boot CPU */
 	xive_setup_cpu_ipi(smp_processor_id());
_

Patches currently in -mm which might be from gouhao@uniontech.com are

powerpc-xive-add-error-return-value-to-xive_smp_probe.patch
drm-remove-dead-warn_on-null-check-after-gfp_nofail-allocation.patch
lib-test_hmm-remove-dead-null-checks-after-gfp_nofail-allocations.patch
rdma-cxgb4-remove-dead-null-checks-after-gfp_nofail-allocations.patch